gro38z[.]net

Analysis indicates that the domain gro38z.net was registered on March 12, 2026 through Realtime Register B.V. and resolved to the IPv4 address 85.158.57.2, which is allocated to AS212238 Datacamp Limited in Poland. The hosting stack was identified as Apache HTTP Server running PHP with a MySQL backend and a WordPress content management system, with client‑side libraries including jQuery. No TLS certificate was presented, meaning the site operated over plain HTTP. The page title returned by the server was “GRO38Z Token – Official Presale Website - Up to 200% Early Participation Bonus”, matching the description of a brand‑impersonation campaign that advertises a cryptocurrency presale.

VirusTotal recorded a single positive detection out of 94 scanned scanners, and the domain appears on one external blocklist, which is also reflected in the PhishDestroy feed that has already taken the site offline. Nameserver configuration points to amanda.ns.cloudflare.com and ashton.ns.cloudflare.com, indicating use of Cloudflare DNS services. The current status is offline, but the underlying infrastructure remains reachable and could be reused for future campaigns.

Defenders should immediately block both the domain and the associated IP address at perimeter firewalls and proxy filters, add the host to internal threat intelligence feeds, and monitor for any new domains that resolve to the same ASN or exhibit the same WordPress‑Apache‑PHP fingerprint. Continuous re‑scanning of the IP range is advised, as the absence of TLS and the presence of a single vendor flag suggest a low‑profile but potentially active phishing operation. Because the site content has not been captured, analysts should treat any claims about the presale details as unverified and focus on the infrastructure indicators provided.